GHSA-5xpp-75jx-m839: systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

Summary On Linux, systeminformation's networkInterfaces() is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive. While collecting per-interface DHCP state, the library reads /etc/network/interfaces and, for every source <path> line it encounters, extracts the path token *from the file content* and interpolates it unquoted into a shell command string that is run via execSync(). A source line whose path contains shell metacharacters executes arbitrary commands with the privileges of the calling Node.js process. This is the same root-cause class as the previously-fixed NetworkManager-connection-name injection in this file: a value parsed out of local system state is re-interpolated into a shell command string without sanitization. The NetworkManager paths were converted to argument-array execution, but the interfaces(5) source-recursion sink in checkLinuxDCHPInterfaces() was left unfixed and still builds a shell string. The input to this sink is *unsanitized* (unlike the iface/connectionName paths, which pass through util.sanitizeString in strict mode before reaching their commands). Impact An attacker who can place or influence a sourced path in /etc/network/interfaces (or any file it transitively sources) achieves command execution inside any process that calls networkInterfaces(). Realistic affected deployments are the same ones that motivate this library: - local inventory / asset agents - monitoring and diagnostics agents - admin-dashboard backends collecting host information - device-management / desktop agents If such a process runs with elevated privileges, the injected command runs with those privileges. networkInterfaces() is a core, frequently-called API and is reached transitively by getStaticData() / getAllData(), so the sink is exercised by ordinary usage on Linux. Threat model The dangerous value is not a function argument supplied by the caller. It is read from the *content* of an interfaces(5) configurat